Machine data-derived key performance indicators with per-entity states

• US 10,650,051 B2
• Filed: 12/12/2016
• Issued: 05/12/2020
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Alekseyev, Leonid Viktorovich, Bingham, Brian John, Fletcher, Tristan Antonio, Reyes, Brian C.
• Primary Examiner(s): Tran, Nam T
• Application Number:
  US15/376,516
• Publication Number:
  US 20170155558A1
• Time in Patent Office: 1,247 Days
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

Raw machine data are captured and may be organized as events. Entity definitions representing machine entities that perform a service identify the machine data pertaining to respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. The derivation may be performed on a per-entity basis and on the aggregate. The derived values may then be translated into a state value domain using per-entity thresholds, aggregate thresholds, or a combination.

Claims

1. A method comprising:

receiving information indicating one or more thresholds associated with a key performance indicator (KPI) and a per-entity application of the thresholds, the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, wherein the value reflects a measure of the performance of the service;

storing the thresholds in association with the KPI in accordance with the received information such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query to produce an instance of the value, on a per-entity basis for at least one of the entities in accordance with the thresholds and a per-entity contribution to the instance of the value;

wherein the service corresponds to a stored service definition associating KPI information comprising the search query and associating an entity definition for each of the one or more entities, each entity definition comprising information to identify machine data pertaining to the respective entity;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by a computer system comprising one or more processors coupled to computer storage.

2. The method of claim 1 wherein receiving information includes receiving information based on user interaction with an interface having one or more interface components enabling a user to indicate at least one of the thresholds and the per-entity application of the thresholds.

3. The method of claim 1 wherein receiving information includes receiving information based on user interaction with an interface having an interface component enabling a user to indicate at least one of the one or more thresholds.

4. The method of claim 1 wherein receiving information includes receiving information based on user interaction with an interface having a first interface component enabling a user to indicate at least one of the one or more thresholds and a second interface component enabling a user to indicate the per-entity application of the thresholds.

5. The method of claim 1 wherein the determining of the KPI state includes:

determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity to produce the per-entity contribution; and

selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.

6. The method of claim 1 wherein the determining of the KPI state includes:

determining an overall contribution by applying a determination component of the search query to the machine data;

determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity to produce the per-entity contribution; and

selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.

7. The method of claim 1 further comprising:

causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.

8. The method of claim 1 further comprising:

causing display of a user interface showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity.

9. The method of claim 1 wherein the machine data associated with at least one of the entities comes from more than one source.

10. The method of claim 1 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.

11. The method of claim 1 wherein the machine data is represented as stored event instances each having a segment of raw machine data.

12. The method of claim 1 wherein the machine data is represented as stored events, the stored events created without reference to the stored service definition.

13. The method of claim 1 wherein the machine data is represented as stored events each having a timestamp, the stored events created without reference to the stored service definition.

14. A system comprising:

a memory; and

a processing device coupled with the memory to;

receive information indicating one or more thresholds associated with a key performance indicator (KPI) and a per-entity application of the thresholds, the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, wherein the value reflects a measure of the performance of the service;

store the thresholds in association with the KPI in accordance with the received information such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query to produce an instance of the value, on a per-entity basis for at least one of the entities in accordance with the thresholds and a per-entity contribution to the instance of the value; and

wherein the service corresponds to a stored service definition associating KPI information comprising the search query and associating an entity definition for each of the one or more entities, each entity definition comprising information to identify machine data pertaining to the respective entity;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

15. The system of claim 14 wherein to receive information includes receiving information based on user interaction with an interface having one or more interface components enabling a user to indicate at least one of the thresholds and the per-entity application of the thresholds.

16. The system of claim 14 wherein the determining of the KPI state includes:

determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity to produce the per-entity contribution; and

selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.

17. The system of claim 14 wherein the determining of the KPI state includes:

determining an overall contribution by applying a determination component of the search query to the machine data;

determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity to produce the per-entity contribution; and

selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.

18. The system of claim 14, the processing device coupled with the memory further to:

cause display of a user interface showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.

19. The system of claim 14, the processing device coupled with the memory further to:

cause display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity.

20. The system of claim 14 wherein the machine data associated with at least one of the entities comes from more than one source.

21. The system of claim 14 wherein the machine data is represented as stored events each having a segment of raw machine data.

22. The system of claim 14 wherein the machine data is represented as stored events, the stored events created without reference to the stored service definition.

23. The system of claim 14 wherein the machine data is represented as stored events each having a timestamp, the stored events created without reference to the stored service definition.

24. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

receiving information indicating one or more thresholds associated with a key performance indicator (KPI) and a per-entity application of the thresholds, the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, wherein the value reflects a measure of the performance of the service;

storing the thresholds in association with the KPI in accordance with the received information such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query to produce an instance of the value, on a per-entity basis for at least one of the entities in accordance with the thresholds and a per-entity contribution to the instance of the value; and

wherein the service corresponds to a stored service definition associating KPI information comprising the search query and associating an entity definition for each of the one or more entities, each entity definition comprising information to identify machine data pertaining to the respective entity;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

25. The non-transitory computer readable storage medium of claim 24, wherein receiving information includes receiving information based on user interaction with an interface having one or more interface components enabling a user to indicate at least one of the thresholds and the per-entity application of the thresholds.

26. The non-transitory computer readable storage medium of claim 24, wherein the determining of the KPI state includes:

determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity to produce the per-entity contribution; and

selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.

27. The non-transitory computer readable storage medium of claim 24, wherein the determining of the KPI state includes:

determining an overall contribution by applying a determination component of the search query to the machine data;

determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity to produce the per-entity contribution; and

selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.

28. The non-transitory computer readable storage medium of claim 24, the operations further comprising:

causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.

29. The non-transitory computer readable storage medium of claim 24, the operations further comprising:

causing display of a user interface showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity.

30. The non-transitory computer readable storage medium of claim 24 wherein the machine data is represented as stored events, the stored events created without reference to a stored definition of the service.